AdaptiveGRC software contains a stored XSS vulnerability (CVE-2026-4313) allowing…
AdaptiveGRC software contains a stored XSS vulnerability (CVE-2026-4313) allowing authenticated attackers to steal admin tokens and escalate privileges.
CERT Polska coordinated the disclosure of CVE-2026-4313, a stored cross-site scripting vulnerability in AdaptiveGRC software. The flaw exists in text-type fields across forms where authenticated attackers can inject malicious JavaScript by manipulating HTTP POST request values. Due to improper server-side validation, the injected code executes in victim browsers when they view the affected fields.
The most critical impact is the potential theft of administrator authentication tokens, enabling attackers to perform arbitrary administrative actions and potentially achieve full system compromise. All AdaptiveGRC versions released before December 2025 are affected by this vulnerability.
The vulnerability was responsibly disclosed by Antoni Kwietniewski from mBank and coordinated through CERT Polska's vulnerability disclosure process. Organizations using AdaptiveGRC should upgrade to versions released after December 2025 to remediate this issue.
Mentioned in this report
Detection guidance
Possible Stored XSS Payload Injection via HTTP POST (AdaptiveGRC CVE-2026-4313)
Detects HTTP POST requests containing inline JavaScript/script tags submitted to AdaptiveGRC form fields, indicative of stored XSS payload injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Possible Stored XSS Payload Injection via HTTP POST
id: a8dce28a-64a3-539e-b7c2-12bdd558b5e9
status: experimental
description: Detects HTTP POST requests containing script tags or inline JavaScript
event handlers in request body/query fields, consistent with stored XSS payload
injection such as CVE-2026-4313 in AdaptiveGRC.
references:
- CVE-2026-4313
logsource:
category: webserver
product: windows
detection:
selection:
cs-method: POST
payload_indicators:
cs-uri-query|contains:
- <script
- onerror=
- onload=
- 'javascript:'
- document.cookie
condition: selection and payload_indicators
falsepositives:
- Legitimate rich-text or HTML content submitted by trusted administrators
- Security scanners or penetration testers actively testing the application
level: medium
tags:
- attack.t1059.007
- attack.execution
author: Vorant
Suspicious Access Token / Cookie Exfiltration Pattern in Web Requests
Detects outbound HTTP requests containing session cookie or authentication token values in URI/query parameters, potentially indicating browser session hijacking following stored XSS exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Session Token Exfiltration via HTTP Request
id: f6bbd9fd-807d-5591-91d9-a3eb6abaa0e3
status: experimental
description: Detects outbound HTTP GET/POST requests where the query string or body
appears to contain session cookie or token values, consistent with exfiltration
of stolen administrator session tokens after a stored XSS attack (e.g. CVE-2026-4313).
references:
- CVE-2026-4313
logsource:
category: proxy
product: windows
detection:
selection:
c-uri|contains:
- document.cookie
- sessionid=
- auth_token=
- PHPSESSID=
condition: selection
falsepositives:
- Legitimate application debugging or analytics scripts that echo cookie values for
troubleshooting
- Internal monitoring tools that log session identifiers for support purposes
level: medium
tags:
- attack.t1185
- attack.collection
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-4313
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free